an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

6
votes
1answer
2k views

how to use common modulus attack?

I am struck with the following problem: Let Alice, Bob, Chris and Eve communicate over a public network. They encrypt all messages they send using RSA system. Bob and Chris have the RSA modulus $...
10
votes
4answers
6k views

Why is it important that phi(n) is kept a secret, in RSA?

Why is it important that $\phi(n)$ is kept a secret, in RSA?
1
vote
0answers
20 views

Is using same key pair for both encryption and signing secure in RSA [duplicate]

In GPG, we can use same key pair for encryption and signing. Can't/Shouldn't we do this in RSA. I am using RSAES-OAEP and RSASSA-PSS, not raw RSA btw.
0
votes
0answers
79 views

How to decrypt RSA cipher text? [closed]

How can I decrypt an RSA cipher text in which I am only provided with a public key and the cipher text. The person who encrypted it made a mistake in taking the exponent.
2
votes
2answers
109 views

Is it possible to recover an RSA modulus from its signatures?

Let's say that you have some small number of RSA signatures of known data: you know some pairs $(m_k, c_k)$ such that ${c_k}^e \equiv m_k \pmod n$. If you know $e$, because probably it's one of $\{3, ...
2
votes
1answer
70 views
1
vote
0answers
52 views

Usefulness of ability to calculate $m^{p+q}$ with RSA

I noticed that with only an RSA public key, it is possible/tractable to calculate $m^{p+q} \pmod n$ for any $m$ without knowing $p$ or $q$. Namely, $m^{p+q} \equiv m^{n+1} \pmod n$. (This follows ...
0
votes
1answer
151 views
2
votes
2answers
116 views

How do you communicate the hash function used with RSA signing?

When it comes to RSA signing, I understand why you need to hash the data before signing it, but don't you need to communicate what hash algorithm you use to whoever will need to verify the signature? ...
2
votes
2answers
132 views

Possible to guess RSA public key $e$ using $n$ and $\phi$

We know that if $n$ and $\phi$ is known, then it is possible to find $p$ and $q$ (initial prime numbers). I have following the questions: Assume the public key $e$ is not known, how difficult would ...
5
votes
3answers
735 views

Is it possible to reduce the size of an RSA key?

The details about what an RSA key is made up of are explained succinctly here. Is it possible to reduce the amount of data that's usually packaged with the (private) key and then derive it later?
1
vote
1answer
262 views

Large primes p and q for RSA

I am writing a high-school paper on textbook RSA (the mathematical aspect only). Many definitions of the RSA method start off with saying that one should: Generate two large random (and distinct) ...
0
votes
0answers
256 views

File encryption using per-user-encrypted shared key

So I'm looking to encrypt files using AES CTR, using a shared key which would be accessed via a per-user password. My two main concerns are: - making sure that the algorithms in use are appropriate ...
2
votes
1answer
52 views

What is the most an adversary can do in the context of public key masquerading?

Suppose two parties A and B are using a public-key encryption scheme in order to communicate securely. A and B both have a public/private key pair: $$ A: (P_A, S_A), B: (P_B, S_B)$$ and A already ...
6
votes
1answer
230 views

RSA reconstructing private key knowing MSBs

PREMISE: This question is purely theoretical because usually an attacker will not know private exponent d and can't compare it with obtained MSB bytes. Suppose an RSA 1024 bit signature. An attacker ...
0
votes
0answers
87 views

public/private key: is it possible to have master public/private key

This may be a very primitive question which might not be possible but I have this question to understand. Assume Yahoo provides a messenger where yahoo users can chat in secure way (end-end ...
1
vote
0answers
102 views

Fingerprint RSA public key in PKCS1 format

I can't find anywhere details on how to fingerprint a public RSA key in PKCS1 format. There are a lot of examples on the internet on how to fingerprint an RSA public key in openssh format using ...
5
votes
2answers
1k views

Is RSA key size the size of private key exponent?

I have implemented a key pair generation scheme for RSA algorithm. I have taken the length of private key exponent as RSA key size, but then I've got to know that RSA key size is the size of the ...
5
votes
2answers
246 views

lcm versus phi in RSA

In textbook RSA, the Euler $\varphi$ function $$\varphi(pq) := (p-1)(q-1)$$ is used to define the private exponent $d$. On the other hand, real-world cryptographic specifications require the ...
0
votes
0answers
29 views

Understanding RSA [duplicate]

I'm reading RSA in Cryptography Course. There is portion of RSA that's confusing me. In Handbook of Applied Cryptography its written Represent the message $M$ as ...
2
votes
1answer
253 views

RSA Signature Verification Implementation on Cortex M0

I have to implement RSA Signature Verification procedure (RSA-2048) on a Cortex M0 based MCU. My budget is 15kB Flash and 2-4kB Flash RAM. Is it even possible to do RSA on a low end MCU based on ...
39
votes
5answers
9k views

How are primes generated for RSA?

As I understand it, the RSA algorithm is based on finding two large primes (p and q) and multiplying them. The security aspect is based on the fact that it's difficult to factor it back into p and q. ...
2
votes
2answers
176 views

Does it necessarily mean that an RSA moduli generated with poor randomness is not random?

In 2012 a group of researchers collected a large amount of RSA moduli and calculated their greatest common divisor in order to find common factors between them. By finding a common factor they could ...
0
votes
0answers
105 views

Values of p and q when e = 3 (RSA)?

I am doing a paper on textbook RSA (this is for high school btw) and in my example I need two very large primes, but I want my $e = 3$. Is there a short way to calculate the values of $p$ and $q$ ...
2
votes
1answer
142 views

Verify a RSA signature using only RSA encryption

I'm trying to verify a RSA signed message, however, the API that I have access to in that environment only has encrypt and decrypt. I think I understand that verification and encryption with public ...
2
votes
1answer
267 views

ECDH or RSA more secure for symmetric key wrapping?

Suppose a message is encrypted with a symmetric block cipher with a random key. RSA is often used to wrap the symmetric key using the recipient's public key. In this case, the size of the message is ...
2
votes
1answer
165 views

Wanted: Simple ring signature example

I spent all day trying to figure ring signature schemes out but apparently I wasted time. I read the original ring signature paper (Rivest's How to leak a secret). I'm having numerous problems. Let's ...
4
votes
3answers
431 views

Can an ephemeral RSA key give forward secrecy?

Suppose party A generates an ephemeral RSA key and sends the public key to B. Party B then generates a symmetric key, encrypts it with Party A's public key and sends the Ciphertext to Party A. Party ...
3
votes
1answer
174 views

RSA 1024 bit forge a new matching signature from a chosen message

I have an RSA signature scheme with 1024-bit key where I know the following: Public modulus $N$ Public exponent $e=3$ A lot of signatures Summary: To compute a signature, an MD5 hash is ...
2
votes
2answers
114 views

Inverting RSA function

I am in high school and I am writing a paper on RSA. I want to show that low values of the public key exponent can make it easy to 'invert' the function so that the encrypted message can be recovered. ...
6
votes
3answers
200 views

Is there an upper bound to the private exponent in RSA?

In the RSA algorithm, we choose $p$ and $q$ as prime numbers and we select a value $e$ which is coprime to $\varphi(pq)=(p-1)(q-1)$. Then we calculate $d:=e^{-1}\bmod\varphi(pq)$. My question is: ...
1
vote
1answer
96 views

How is RSA able to prevent brute forcing using the public key?

Bob calculates a private and public key. Bob sends his public key to John. Jeff is a third party unwanted member and manages to snatch the public key mid-transfer. John encrypts his message ...
92
votes
4answers
59k views

Why is elliptic curve cryptography not widely used, compared to RSA?

I recently ran across elliptic curve crypto-systems: An Introduction to the Theory of Elliptic Curves (Brown University) Elliptic Curve Cryptography (Wikipedia) Performance analysis of identity ...
1
vote
2answers
202 views

How is message length involved in public/private-key encryption?

I've just read this question regarding why to sign only the hash of a message. I kind of understood the answer, but the question arisen is now: Why can I encrypt any text messages with the same ...
0
votes
1answer
1k views

generate RSA public key having public modulus and exponent [closed]

i want to generate an RSA public public key file using openssl (or other tools) having public modulus and exponent, so i can use it later to encrypt files i have this: ...
1
vote
0answers
36 views

Is it possbile to get same set of public and private keys twice while creating CSR ? If so where does the conflict happens !?

I'm new to cryptography and please clarify if my below assumption is wrong. Lets assume, that two different banks creating CSR and they get identical public and private key pairs of RSA. In such ...
5
votes
1answer
421 views

Timing Attack on RSA

So far I have researched on timing attack on RSA, We all know the ransomware named Cryptolocker it uses RSA 2048 bit encryption. Now is it possible to break the encryption using timing attack. I have ...
1
vote
1answer
218 views

Shared modulus attack on RSA

Consider a scenario in which a group of people use a common modulus $n$ in the textbook RSA crypto system, where $n=pq$, $p$ and $q$ are large distinct prime numbers. Is there any chance for an ...
3
votes
1answer
93 views

How to understand RSA Proofs of correctness at Wikipedia

From Wikipedia(https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Proofs_of_correctness): $m^{ed}$ ≡ $m$ $\pmod{q}$ $m^{ed}$ ≡ $m$ $\pmod{p}$ then $m^{ed}$ ≡ $m$ $\pmod{pq}$ Question: if $m^{ed}$ ...
4
votes
3answers
585 views

Does RSA operate over a Finite Field (Galois Field)?

Is it correct to say that RSA operates over a Finite Field (Galois Field)? In this case GF(p)? I do understant that the modulo in RSA is not itself a prime number, but all the operations (...
4
votes
1answer
79 views

Adding two RSA private key

We've constructed a new private RSA key from two known private RSA keys $Priv_1$ and $Priv_2$ as follows: $$p = next\underline{}prime\left(\frac{Priv_1(p) + Priv_2(p)}{2}\right)$$ and $$q = next\...
2
votes
0answers
112 views

Limit the number of private key uses for RSASSA-PKCS1-v1_5 with SHA-256 signature?

Assuming all messages and their signatures are available to the attacker, is it secure to use the same RSA private key to sign many messages (roughly $10^{6}$) via PKCS#11 ...
0
votes
0answers
16 views

In the RSA encryption system, are there not multiple messages m that give the same cipher text c? [duplicate]

For example: p = 5, q = 11, n = 55 $\phi$(55) = 40 e = 3, $\phi$(55) and 3 are relatively prime m = 3, then: $3^3 mod(55) = 27$ m = 113, then: $113^3 mod(55) = 27$ I heard that e and $\phi$(n) ...
1
vote
1answer
181 views

How to determine the RSA Private key size from the Public.key file?

Question: How to determine the RSA Private key size from the Public.key file? Just roughly, how big it could be? ...
0
votes
1answer
157 views

1024 RSA Hash Signature attack. Forge a valid signature

I have an RSA signature of 1024 bit where i know the following: Public modulus N Public exponent (0x03) Cypher message Summary: An MD5 hash is calculated from a collection of byte and is used as ...
2
votes
1answer
59 views

Why can we ignore $y$ when using the extended Euclidean algorithm to calculate an RSA decryption exponent?

I have a follow-up question about the extended Euclidean algorithm, as applied to RSA key generation, described in this answer. Let us say we have $p=5$, $q=11$ and $e=17$, so that $N=55$ and $φ(N)=...
0
votes
1answer
50 views

How to deliver an encrypted message to multiple recipients without revealing keys

Let's say I have generated a private and a public key. I create a message and encrypt it with the public key. I deliver this encrypted message and a private key to multiple recipients. Why would I do ...
2
votes
2answers
494 views

Is it safe to reuse a symmetric key when using asymmetric encryption?

I've written a C# Library that I hope will be used for security purposes in a commercial application. The application will communicate through the internet and not on an internal network. I am using ...
2
votes
2answers
405 views

RSA: Is it secure to use the private key to encrypt and the public key to decrypt?

This may sound weird: What if I don't let others know my public key, then use my private key to encrypt, and the public key to decrypt? Is this secure? Let me explain a little bit: Common usuage: ...
3
votes
0answers
30 views

Authenticate encrypted seed for KEM + AEAD hybrid cryptosystem

Say I want to encrypt something using RSA / KEM and an authenticated cipher. I encrypt using the following scheme: generate random seed z using ...